The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was a landmark Act through its eliminating much of the protection that previously existed with respect to patient information held by a treating clinician. The Privacy Rule, a component of HIPAA, allows the treating clinician to disclose otherwise protected health information without any authorization or permission by the patient, in 12 specific instances: to employers who request information concerning a work-related illness or injury; under a wide variety of local statutes, regulations and court orders; to governmental authorities where victims of abuse, neglect or domestic violence are involved; in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; or when a clinician believes that protected health information is evidence of a crime that occurred on its premises.

That is but a small sampling of the wide range of disclosures that are permitted under HIPAA, again with absolutely no permission required from the patient. Can you imagine? Under HIPAA, if a clinician feels that a patient might have given a controlled substance to another patient while on the premises, thereby committing a crime, the clinician could comfortably turn both patients in to law enforcement officials. Similarly, an eager new law enforcement agent suspecting such behavior among your methadone program patients could request your records and under HIPAA fully expect that you would deliver these records at once.

Thankfully, we have federal confidentiality regulations at 42 CFR Part 2, commonly called simply Part 2, which take precedence and protect our patients. Part 2 applies to all medical information about any person who has applied for or been given a diagnosis or treatment for substance use disorders at a federally assisted program. Within Part 2 is